All Apps and Add-ons

How are the severity and risk related in terms of Palo Alto Threat logs?

apoorvaa
New Member

How are the severity and risk related in terms of Palo Alto Threat logs?

0 Karma
1 Solution

btorresgil
Builder

In a threat log, the severity refers to the threat itself. This can have a high, low, critical, informational severity level, based on the threat itself. The risk refers to the application that the threat is leveraging. So, for example, if the threat is coming over smtp, that is a risk 5 application (high risk), but maybe the severity of the threat was something benign, so the severity is 'informational'. This example indicates a very minimal severity event that took place on a usually high risk application or protocol.

Other log types besides 'threat' (like traffic or url logs) will still have a risk related to the application in those logs, but because there is no threat referenced in these log types, there will not be a severity.

The new Palo Alto Networks App version 5.0 and Add-on clarify this distinction by prefixing the field names. The new field names are app:risk and threat:severity.

If you decide to upgrade, please use the upgrade guide to migrate to App version 5.0:
http://pansplunk.readthedocs.org/en/latest/upgrade.html

View solution in original post

0 Karma

btorresgil
Builder

In a threat log, the severity refers to the threat itself. This can have a high, low, critical, informational severity level, based on the threat itself. The risk refers to the application that the threat is leveraging. So, for example, if the threat is coming over smtp, that is a risk 5 application (high risk), but maybe the severity of the threat was something benign, so the severity is 'informational'. This example indicates a very minimal severity event that took place on a usually high risk application or protocol.

Other log types besides 'threat' (like traffic or url logs) will still have a risk related to the application in those logs, but because there is no threat referenced in these log types, there will not be a severity.

The new Palo Alto Networks App version 5.0 and Add-on clarify this distinction by prefixing the field names. The new field names are app:risk and threat:severity.

If you decide to upgrade, please use the upgrade guide to migrate to App version 5.0:
http://pansplunk.readthedocs.org/en/latest/upgrade.html

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...